The vulnerability resides in the author management feature of SPIP CMS, where the status field is incorrectly handled, allowing a non‑administrator to assign administrator privileges to an author record. This flaw permits an attacker to elevate privileges to full administrative control over the site, potentially compromising confidential data, modifying site settings, and executing further attacks. The weakness corresponds to inadvertent privilege assignment as classified by CWE‑688.

The issue affects SPIP CMS versions 4.4.10 through 4.4.12. The vendor SPIP is identified as the affected product. Users running these releases are susceptible to the flaw, while version 4.4.13 and later are not impacted.

The CVSS score of 6.7 places the vulnerability in the medium severity range, and the EPSS score of less than 1% indicates a low likelihood of widespread exploitation at present. The flaw is not listed in the CISA Known Exploited Vulnerabilities catalog, suggesting it has not yet been abused in the wild. However, exploitation is feasible via the normal administrative interface; an attacker would need to create or edit an author record, after which the SYSTEM could grant administrative rights. This represents a significant risk to site owners who rely on the default SPIP author management workflow.